Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-109400 | high | 7.5 | No | The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and i... | 2026-10-16 |
| CVE-2026-110467 | medium | 4.3 | No | Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specif... | 2026-10-16 |
| CVE-2026-110445 | high | 8.8 | No | TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users int... | 2026-10-16 |
| CVE-2026-110444 | high | 8.8 | No | TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users int... | 2026-10-16 |
| CVE-2026-108925 | medium | 6.1 | No | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Cohesity NetBackup Administration Console web... | 2026-10-16 |
| CVE-2026-107746 | high | 7.5 | No | The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in all versions up to, an... | 2026-10-16 |
| CVE-2026-107605 | medium | 6.2 | No | SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could al... | 2026-10-16 |
| CVE-2026-106170 | medium | 4.9 | No | An Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6,... | 2026-10-16 |
| CVE-2026-107437 | medium | 6.2 | No | GV-E-Map Server V18.2.0A contains a plaintext database password embedded within an application component. The credential can be recovered th... | 2026-10-16 |
| CVE-2026-107373 | critical | 9.1 | No | ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument.... | 2026-10-16 |
| CVE-2026-104000 | high | 7.2 | No | The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all version... | 2026-10-16 |
| CVE-2026-103895 | high | 8.1 | No | The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to,... | 2026-10-16 |
| CVE-2026-103480 | medium | 6.4 | No | The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th... | 2026-10-16 |
| CVE-2026-103636 | high | 7.5 | No | Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C++ (repo: datasketches-cpp). var_opt_union::deserialize() re... | 2026-10-16 |
| CVE-2026-103635 | critical | 9.1 | No | Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). compact_theta_sketch::d... | 2026-10-16 |
| CVE-2026-103513 | critical | 9.8 | No | Out-of-bounds read and write in the CPC sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). A crafted serialized CP... | 2026-10-16 |
| CVE-2026-103501 | critical | 9.8 | No | Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). When deserializing a sketch in... | 2026-10-16 |
| CVE-2026-102064 | high | 7.5 | No | A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacke... | 2026-10-16 |
| CVE-2026-102016 | high | 7.5 | No | An Improper Validation of Specified Quantity in Input vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved all... | 2026-10-16 |
| CVE-2026-102012 | high | 7.5 | No | A Reachable Assertion vulnerability in the na-grpcd process of Juniper Networks Junos OS Evolved allows a remote unauthenticated attacker to... | 2026-10-16 |